/dev/usb/hid (v5)

From WiiBrew
< /dev‎ | usb
Jump to navigation Jump to search

/dev/usb/hid is used to interact with USB HIDs in IOS57, 58 and 59.

It is very similar to /dev/usb/ven and other v5 interfaces. Some ioctl handlers are identical to USB_VEN. Both rely on /dev/usb/usb for most actions.


Handles for USB_HID function exactly the same as for USB_VEN.


Compared to VEN, HID has an additional member at the end of the device structure that seems to be used for keeping track of ongoing transfers.

There can be up to 32 ongoing transfers (in total, for all devices) at the same time. IPC_ERROR_MAX (-5) will be returned by the transfer submission ioctlvs (0x12 and 0x13) if the limit is exceeded (unlike VEN, which returns IPC_EINVAL).

It appears that transfers can be queued. If a transfer is already in progress, any new transfer request will be added to a queue and only processed after some amount of time (depending on *(u32*)(ioctlv.vectors[0].base + 12)?). [check]

When a device is unplugged, all of the queued transfer requests are replied to with return code USB_ECANCELED (-7022), their associated IOS timers are stopped and destroyed.


Ioctl Name Input Output Notes
0 GetVersion Identical to VEN
1 GetDeviceChange Identical to VEN
2 Shutdown Identical to VEN
3 GetDeviceInfo 0x20 bytes

1-2: Device index
2-4: Device number

(0-4 is considered as a whole as the device ID, but IOS only cares about these two values.)

0x60 bytes (memset to 0)

0-4: Device ID
4-8: Unknown byte from ioctl_2_out_buffer[5]
36-56: Device descriptor
56-68: Config descriptor
68-80: Interface descriptor
80-88: Interrupt IN endpoint descriptor
88-96: Interrupt OUT endpoint descriptor

Get USB descriptors for a device. Behind the scenes, calls /dev/usb/usb ioctl 2 (input: internal ID, output: descriptors) and copies information to the output buffer and the internal device struct (must be called before a device can be used).

The descriptor structures match the ones used by libusb (with padding).

This is very similar to VEN, but with different offsets and only interrupt endpoint descriptors, at fixed offsets.

4 ? Identical to VEN
5 ? Identical to VEN
6 AttachFinish Identical to VEN
7 SetAlternateSetting Not available in HID
8 ? Does not exist in HID
0x10 SuspendResume Identical to VEN
0x11 CancelEndpoint ? ? Calls USB backend (EHC or OHCI0) ioctl 0x10

Valid endpoint values: 0 (control), 1 and 2 (interrupt)

Cancels all queued transfers with return code -7022 (USB_CANCELLED).

0x12 (ioctlv) CtrlTransfer (?) ? ? Submit a control transfer.

Appears to use the Starlet timer (HW_TIMER) and possibly rate limit requests [check]

0x13 (ioctlv) IntrTransfer (?) ? ? Submit an interrupt transfer.

Appears to use the Starlet timer (HW_TIMER) and possibly rate limit requests [check]

0x14 (ioctlv) IsoTransfer Not available in HID
0x15 (ioctlv) BulkTransfer Not available in HID